Chapter 17. Accounting

Virtually all current Unix systems provide some form of user-based process accounting: the operating system tracks system usage by recording statistics about each process that is run, including its UID. In addition, records are kept of the image that was run by the process and the system resources (such as memory, CPU time, and I/O operations) that it used.

The accounting system is designed for tracking system resource usage, primarily so that users can be charged money. The data collected by the accounting system can also be used for some types of system performance monitoring and security investigations (see Chapter 15 and Chapter 7).

There are two distinctaccounting systems in use, originating from the traditional vanilla BSD and System V environments. Although they are quite different, they are based on the same raw data. Hence, the sort of information that may be gleaned from them is essentially identical, although output methods and formats are not. They also suffer from the same limitations; for example, neither system provides for project-based accounting in any straightforward way.

As with all accounting systems, the Unix accounting software places a small but detectable load on the system. BSD-style accounting used to be enabled in new systems but is generally disabled these days; the process for enabling it is described later in this chapter. System V-style accounting is always initially disabled and must be set up by the system administrator.

On many systems, the accounting utilities are packaged as a separately installable module that the system administrator may include or not, as appropriate. Since the accounting system is also an important component of performance and system security monitoring, I recommend always installing it, even if you don't need accounting features, because the disk requirements are quite modest.

Accounting capabilities also need to be present in the Unix kernel, and many systems make this configurable as well (although they are usually present in default kernels).

Table 17-1 summarizes the main components of the accounting system for the Unix versions we are considering.

Table 17-1. Unix accounting system components

Accounting component	Location
Accounting system variant	BSD FreeBSD, Linux (extended); AIX, Tru64 (commands only) System V AIX, HP-UX, Solaris, Tru64
Primary accounting data file (default/conventional location shown)	AIX /var/adm/pacct FreeBSD /var/account/acct HP-UX /var/adm/acct/pacct Linux /var/log/pacct (Red Hat); /usr/account/pacct (SuSE) Solaris /var/adm/pacct Tru64 /var/adm/pacct
wtmp data file location	Usual /var/adm FreeBSD /var/log Linux /var/log Solaris /var/adm/wtmpx
utmp data file location	Usual /etc FreeBSD /var/run Linux /var/run Solaris /var/adm/utmpx Tru64 /var/adm
lastlog data file location	Usual /var/log AIX /etc/security HP-UX not used Tru64 /var/adm
Accounting supplemental utilities directory	AIX /usr/sbin/acct, /usr/lib/sa FreeBSD none HP-UX /usr/sbin/acct Linux /usr/lib/sa Solaris /usr/lib/acct Tru64 /usr/sbin/acct
Boot script that starts accounting	AIX Edit /etc/rc or other boot script FreeBSD /etc/rc HP-UX /sbin/init.d/acct Linux none provided (Red Hat); /etc/init.d/acct (SuSE) Solaris /etc/init.d/acct Tru64 /sbin/init.d/acct
Boot script configuration file (and accounting-enabling entry)	Usual none used FreeBSD /etc/defaults/rc.conf or /etc/rc.conf (accounting_enable="YES") HP-UX /etc/rc.config.d/acct (START_ACCT=1) Linux /etc/rc.config (SuSE 7) (START_ACCT="yes") Tru64 /etc/rc.config (ACCOUNTING="YES")
Available printer accounting	AIX /usr/sbin/pac FreeBSD /usr/sbin/pac HP-UX none provided Linux lprng accounting.pl (Red Hat); /usr/sbin/pac (SuSE) Solaris none provided Tru64 /usr/sbin/pac

A couple of the utilities we considered in the context of security monitoring, lastcomm and lastlog (in Chapter 7), are also useful for producing accounting reports. See the earlier discussion for details.